{"action":"created","issue":{"url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair/issues/6","repository_url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair","labels_url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair/issues/6/comments","events_url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair/issues/6/events","html_url":"https://github.com/agens-no/EllipticCurveKeyPair/issues/6","id":269031919,"number":6,"title":"Access control is not respected ","user":{"login":"badlands","id":304276,"avatar_url":"https://avatars3.githubusercontent.com/u/304276?v=4","gravatar_id":"","url":"https://api.github.com/users/badlands","html_url":"https://github.com/badlands","followers_url":"https://api.github.com/users/badlands/followers","following_url":"https://api.github.com/users/badlands/following{/other_user}","gists_url":"https://api.github.com/users/badlands/gists{/gist_id}","starred_url":"https://api.github.com/users/badlands/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/badlands/subscriptions","organizations_url":"https://api.github.com/users/badlands/orgs","repos_url":"https://api.github.com/users/badlands/repos","events_url":"https://api.github.com/users/badlands/events{/privacy}","received_events_url":"https://api.github.com/users/badlands/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-10-27T08:49:14Z","updated_at":"2017-10-27T09:20:26Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\nI faced issues when using your code with a kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly protection level.\r\n\r\n```\r\n        let protection = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly\r\n        let config = EllipticCurveKeyPair.Config(\r\n            publicLabel: self.publicLabel,\r\n            privateLabel: self.privateLabel,\r\n            operationPrompt: \"\",\r\n            accessControl: try! SecAccessControl.create(protection: protection, flags: [.privateKeyUsage]),\r\n            fallbackToKeychainIfSecureEnclaveIsNotAvailable: true)\r\n        return EllipticCurveKeyPair.Manager(config: config)\r\n```\r\n\r\nIf you lock the device, wait a few seconds (10+), and you try to decrypt (I found it useful to trigger the decrypt method with a notification), you get this error:\r\n\r\n`decode keys,rowid=760 failed (-25308): Error Domain=NSOSStatusErrorDomain Code=-25308 \"ks_crypt: e00002e2 failed to 'od' item (class 6, bag: 0) Access to item attempted while keychain is locked.\" UserInfo={NSDescription=ks_crypt: e00002e2 failed to 'od' item (class 6, bag: 0) Access to item attempted while keychain is locked.}`\r\n\r\nClass 6 is: kSecAttrAccessibleWhenUnlocked (see this thread on [SO](https://stackoverflow.com/questions/31197774/ios-8-notification-action-access-to-item-attempted-while-keychain-is-locked-e#31355906))\r\n\r\nThe item should not belong to Class 6.\r\n\r\nI managed to solve this issue by applying this change:\r\n\r\n```\r\n        static func forceSavePublicKey(_ publicKey: PublicKey, label: String) throws {\r\n            // I will create a SecAccessControl\r\n            var error: Unmanaged<CFError>?\r\n            \r\n            let sacObject = SecAccessControlCreateWithFlags(kCFAllocatorDefault, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, [], &error)\r\n            //\r\n            \r\n            let query: [String: Any] = [\r\n                kSecClass as String: kSecClassKey,\r\n                kSecAttrLabel as String: label,\r\n                kSecValueRef as String: publicKey.underlying,\r\n                /* I will apply the SecAccessControl object to the public key */\r\n                kSecAttrAccessControl as String: sacObject!,\r\n            ]\r\n            \r\n            var raw: CFTypeRef?\r\n            var status = SecItemAdd(query as CFDictionary, &raw)\r\n            if status == errSecDuplicateItem {\r\n                status = SecItemDelete(query as CFDictionary)\r\n                status = SecItemAdd(query as CFDictionary, &raw)\r\n            }\r\n            guard status == errSecSuccess else {\r\n                throw Error.osStatus(message: \"Could not save public key\", osStatus: status)\r\n            }\r\n        }\r\n    } \r\n```\r\n\r\nThis is a rough patch, imho you should re-use what you already have in the Config object."},"comment":{"url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair/issues/comments/339920106","html_url":"https://github.com/agens-no/EllipticCurveKeyPair/issues/6#issuecomment-339920106","issue_url":"https://api.github.com/repos/agens-no/EllipticCurveKeyPair/issues/6","id":339920106,"user":{"login":"badlands","id":304276,"avatar_url":"https://avatars3.githubusercontent.com/u/304276?v=4","gravatar_id":"","url":"https://api.github.com/users/badlands","html_url":"https://github.com/badlands","followers_url":"https://api.github.com/users/badlands/followers","following_url":"https://api.github.com/users/badlands/following{/other_user}","gists_url":"https://api.github.com/users/badlands/gists{/gist_id}","starred_url":"https://api.github.com/users/badlands/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/badlands/subscriptions","organizations_url":"https://api.github.com/users/badlands/orgs","repos_url":"https://api.github.com/users/badlands/repos","events_url":"https://api.github.com/users/badlands/events{/privacy}","received_events_url":"https://api.github.com/users/badlands/received_events","type":"User","site_admin":false},"created_at":"2017-10-27T09:20:26Z","updated_at":"2017-10-27T09:20:26Z","author_association":"NONE","body":"Yes, I was about to vote for option number 2.\n\nOn Fri, Oct 27, 2017 at 11:18 AM, Håvard Fossli <notifications@github.com>\nwrote:\n\n> I'm leaning towards second alternative\n>\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/agens-no/EllipticCurveKeyPair/issues/6#issuecomment-339919610>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AASklNaIARx351tDaxJnWM2uaZsaLvkIks5swZ_RgaJpZM4QIvA1>\n> .\n>\n"}}
{"actor":{"display_login":"badlands"}}